Images of individuals constitute “personal data” under the General Data Protection Regulation (GDPR). The capturing of a person's image and its subsequent use constitutes processing of personal data within the meaning of the GDPR. As with any processing of personal data, the recording of identifiable images of persons must have a legal basis under the data protection legislative frameworks. Individuals have a right to have their personal data processed in a manner that complies with data protection law. 

Article 5(1)(a) of the GDPR provides that personal data “shall be processed lawfully, fairly and in a transparent manner”. There are six legal bases for processing personal data under the GDPR, and a data controller must ensure they can rely on one of these legal bases before they can process the personal data.

The consent of an individual to the processing of his or her personal data can provide a legal basis to process data. However, this may not be practically implementable in cases of large public events where promotional photographs are being taken as a group shot, as it will be difficult to obtain the freely given consent of everyone likely to be photographed. 

Data controllers may seek to rely on the legal basis of “legitimate interests”, that is that they have identified a legitimate interest they wish to pursue, in this case taking promotional photographs and demonstrate that the intended processing of the data subject’s personal data is necessary to achieve their legitimate interest of publishing the photo to show the success of their event.

A data controller must show that it will balance the legitimate interest against the data subjects’ interests, rights, and freedoms. To do so, a controller must process data subjects’ personal data in a way which they would reasonably expect and which would have a minimal impact on their privacy, by virtue of the nature of the processing or safeguards introduced.

In practical terms, at large events it is advisable to have written notices in place advising attendees of the intention to take photos, the purpose of taking the photo and the intended use of the image. At smaller events it is advisable to seek the consent of those attending either in written form or by introducing a method of identifying consent from those whose photographs may be taken, for example, at a conference, green lanyards could be given to those who consent to their photo being taken during the course of the conference, and red lanyards to those who do not consent.